CVE-2026-101915: @grpc/grpc-js Server Error Message Leakage Vulnerability
Summary
CVE-2026-101915: Impact If an application method handler crashes, the error message is included in the status message sent to the client. Affects @grpc/grpc-js across 2 version ranges.
< 1.13.6
>= 1.14.0, < 1.14.5
Fixed in 1.13.6 or 1.14.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @grpc/grpc-js package is a popular library for implementing gRPC (Google Remote Procedure Call) in Node.js applications. It allows developers to create efficient and scalable APIs by enabling communication between clients and servers. However, this package is vulnerable to a specific issue where error messages from method handlers can be transmitted to clients, potentially exposing sensitive information.
Vulnerability Detail
This vulnerability arises when a method handler within the @grpc/grpc-js package crashes, causing the server to send the error message as part of the status message to the client. This can inadvertently leak sensitive data, such as stack traces or internal error messages, to the client, which poses a security risk. The vulnerability affects all versions prior to 1.13.6 and between 1.14.0 and 1.14.5, making it crucial for users to be aware of the potential ramifications of exposing sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.13.61.13.6npm install @grpc/grpc-js@1.13.6 -
>= 1.14.0, < 1.14.51.14.5npm install @grpc/grpc-js@1.14.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, implement a top-level error handler in your method handlers to strip out sensitive error information before it is sent to the client. Here is an example of how to do this:
function myMethodHandler(call, callback) {
try {
// Your method logic here
} catch (error) {
// Handle the error and avoid sending sensitive information
callback({ code: grpc.status.INTERNAL, message: 'An error occurred' });
}
}
Conclusion
The @grpc/grpc-js package has a vulnerability that can leak sensitive error messages to clients when method handlers crash. It is essential to update to the patched versions or implement workarounds to mitigate this risk. Regular monitoring of open-source vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for @grpc/grpc-js →
FAQ
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Versions prior to 1.13.6 and between 1.14.0 and 1.14.5 are affected by this vulnerability.
If you cannot update the package immediately, implement a top-level error handler in your method handlers to prevent sensitive information from being sent to clients.
More information can be found in the advisory database at GitHub, specifically at the link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-f596-whhp-79r4/GHSA-f596-whhp-79r4.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for @grpc/grpc-js.
